| #1 | RestroPress – Online Food Ordering System | 17 | 527 | 3,189 | 1k+ | | | Non-prefixed global variable |
| #2 | wpForo Forum | 17 | 4,048 | 2,922 | 20k+ | | | Unsafe printing function |
| #3 | Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons | 19 | 10,340 | 360 | 100k+ | | | Text Domain Mismatch |
| #4 | Verified Reviews (Avis Vérifiés) | 19 | 671 | 1,136 | 700 | | | Non-prefixed global variable |
| #5 | WP Directory Kit | 19 | 1,502 | 2,641 | 2k+ | | | Non-prefixed global variable |
| #6 | Brizy – Page Builder | 20 | 586 | 726 | 70k+ | | | Output is not escaped |
| #7 | SysBasics Customize My Account for WooCommerce – Live My Account Customizer | 20 | 743 | 911 | 8k+ | | | Non-prefixed global variable |
| #8 | Event Espresso – Event Registration & Ticketing Sales | 20 | 12,698 | 2,135 | 600 | | | Text Domain Mismatch |
| #9 | GiveWP – Donation Plugin and Fundraising Platform | 20 | 3,410 | 3,554 | 100k+ | | | Output is not escaped |
| #10 | Link Library | 20 | 1,941 | 1,392 | 10k+ | | | Unsafe printing function |
| #11 | Brevo – Email, SMS, Web Push, Chat, and more. | 20 | 460 | 646 | 100k+ | | | Request data is not unslashed |
| #12 | پلاگین پرداخت دلخواه | 20 | 584 | 446 | 900 | | | Text Domain Mismatch |
| #13 | Remove Add to Cart WooCommerce | 20 | 616 | 1,378 | 4k+ | | | Non-prefixed global variable |
| #14 | Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF | 20 | 556 | 543 | 100k+ | | | Output is not escaped |
| #15 | Booking Ultra Pro Appointments Booking Calendar Plugin | 21 | 761 | 2,083 | 400 | | | Request data is not unslashed |
| #16 | DELUCKS SEO | 21 | 362 | 1,171 | 400 | | | Missing nonce verification |
| #17 | Eupago Gateway For Woocommerce | 21 | 576 | 233 | 2k+ | | | Output is not escaped |
| #18 | EventPrime – Events Calendar, Bookings and Tickets | 21 | 873 | 4,310 | 7k+ | | | Non-prefixed global variable |
| #19 | FileOrganizer – WordPress File Manager | 21 | 536 | 241 | 200k+ | | | unlink unlink |
| #20 | Campaign Monitor for WordPress | 21 | 386 | 461 | 2k+ | | | Non-prefixed global variable |
| #21 | MotoPress Hotel Booking | 21 | 3,067 | 1,037 | 10k+ | | | Text Domain Mismatch |
| #22 | Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages | 21 | 1,120 | 2,913 | 9k+ | | | Non-prefixed global variable |
| #23 | Five Star Restaurant Reservations – WordPress Booking Plugin | 21 | 1,101 | 1,159 | 10k+ | | | Output is not escaped |
| #24 | Rocket Maintenance Mode & Coming Soon Page | 21 | 1,176 | 1,406 | 4k+ | | | Non-prefixed global variable |
| #25 | URL Shortify – Simple and Easy URL Shortener | 21 | 1,507 | 2,665 | 10k+ | | | Non-prefixed global variable |
| #26 | BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages | 21 | 668 | 1,569 | 800 | | | Non-prefixed global variable |
| #27 | IS-theme-companion | 21 | 3,559 | 511 | 1k+ | | | Non Singular String Literal Domain |
| #28 | Wise Chat | 21 | 470 | 506 | 5k+ | | | Output is not escaped |
| #29 | WP-Lister Lite for eBay | 21 | 6,701 | 5,132 | 2k+ | | | Output is not escaped |
| #30 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin | 21 | 1,812 | 1,432 | 70k+ | | | Output is not escaped |
| #31 | WP Sessions Time Monitoring Full Automatic | 22 | 869 | 1,529 | 500 | | | Non-prefixed global variable |
| #32 | Advanced Classifieds & Directory Pro | 22 | 1,229 | 3,512 | 2k+ | | | Non-prefixed global variable |
| #33 | Author Website Templates – Create Writer, Author & Publisher Websites Easily | 22 | 711 | 2,910 | 500 | | | Non-prefixed global variable |
| #34 | ANAC XML Bandi di Gara | 22 | 294 | 244 | 500 | | | Output is not escaped |
| #35 | Better WordPress Minify | 22 | 412 | 484 | 7k+ | | | Non Singular String Literal Domain |
| #36 | Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms | 22 | 493 | 295 | 10k+ | | | Text Domain Mismatch |
| #37 | Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer | 22 | 2,854 | 1,269 | 50k+ | | | Text Domain Mismatch |
| #38 | RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login | 22 | 3,652 | 5,145 | 8k+ | | | Non-prefixed global variable |
| #39 | DirectoryPress – Business Directory And Classified Ad Listing | 22 | 4,787 | 2,795 | 700 | | | Text Domain Mismatch |
| #40 | Diverse Solutions IDX Real Estate Listings & MLS Search | 22 | 745 | 605 | 1k+ | | | Heredoc Output Not Escaped |
| #41 | Dynamic QR Code – generator | 22 | 238 | 208 | 5k+ | | | Missing direct file access protection |
| #42 | Employee Spotlight – Team Member Showcase & Meet the Team Plugin | 22 | 247 | 689 | 400 | | | Non-prefixed hook name |
| #43 | Events Maker by dFactory | 22 | 588 | 819 | 1k+ | | | Output is not escaped |
| #44 | Events Manager – Calendar, Bookings, Tickets, and more! | 22 | 4,716 | 5,690 | 70k+ | | | Output is not escaped |
| #45 | FunnelKit Payment Gateway for Stripe WooCommerce | 22 | 244 | 321 | 20k+ | | | Input is not sanitized |
| #46 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | 22 | 2,433 | 3,594 | 70k+ | | | Non-prefixed global variable |
| #47 | Mail Baby SMTP | 22 | 385 | 699 | 600 | | | SQL query is not prepared |
| #48 | MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder | 22 | 1,120 | 3,012 | 2k+ | | | Non-prefixed global variable |
| #49 | MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. | 22 | 2,625 | 2,458 | 10k+ | | | Output is not escaped |
| #50 | MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution | 22 | 1,131 | 1,845 | 700 | | | Non-prefixed global variable |